Misuse GCDWebServer of iOS app - A case study

1. Introduction to GCDWebServer

1.1 The GCDWebServer is a modern and lightweight GCD based HTTP 1.1 server designed to be embedded in iOS, macOS & tvOS apps. The library is implemented by Objective-C programming language. Network service is provided by adding handler to this library. There are default handlers serve as file servers which provide file listing, uploading/downing, and file editing (WebDAV) service in this library. Developer can also provide customized service by writing his own handler to execute command according to the client's request.

1.2 Misusage of this library will expose privacy or functionality to adversary. To find the misusage of this library, we perform a case-by-case study of the interface of this library, then carry out analysis on apps. To promote the performance of automatic analysis of this Objective-C library, we use a combination of signature query and a devised dataflow analysis methodology.

1.3 The 2 models for using this library are:

1) Standard service: The standard service is implemented by using default handler in this library, that is WebServer, WebUploader, or WebDAVServer, which provide file listing, file uploading/downloading, file management service. For such a service, users build request without arguments to get the service. (e.g., http://192.168.1.8 for listing files in Now app.)

2) Customized service. The customized service is implemented by adding/overwriting handler through addDefaultHandlerForMethod:requestClass:processBlock, addDefaultHandlerForMethod:requestClass:asyncProcessBlock, addHandlerForMethod:path:requestClass:processBlock:, addHandlerForMethod:pathRegex:requestClass:processBlock:,

and WebServer. For such a service, users are commonly required to build a request (it depends) with arguments to get the service. (e.g., http://192.168.1.13/manifest?type=master for requesting resource in Amazon Prime Video app.)

2. Security problem when using GCDWebServer

There are a few security problems incur remote attack when misusing this library.

2.1 Leaks privacy. If developer use this library to share file, the wrong configuration will expose privacy within the app. For example, in the initial release of Ionic Webview library, the library use LAN interface when integrating GCDWebServer library, which will expose the whole file system of a jailbroken device to adversary.

2.2 Lack of access control for the handlers. If developer add handler to provide customized functionality, the firmly access control should be enforced. For a customized service, manual analysis must be involved to check the authorize process or the functionalities behind the service.

2.3 Path Traversal attack. Unlike CocoaHTTPServer, which utilizing stringByStandardizingPath API to standardize the path and apply additional checks to prevent Path Traversal attack, there is no security consideration towards this attack in GCDWebServer. That is, adversary can access files outside the web root folder by using a “dot-dot-slash (../)” request when the GCDWebServer is served as a file server (e.g., static website, WebDAV service). For this attack, the web root should be set to Data folder by the developer as to access the privacy (cookies, sessions, etc.) within an app. If the web root folder is set to Bundle folder (use NSBundle as Ionic's Webview does), it's hard for the adversary to predict the randomly generated Data path to access privacies of an app. e.g., CloudLink, a HuaWei's app use host field in a HTTP header to verify a request, however, it's can be easily impersonated by an attacker, fortunately, the root web folder is set to Bundle folder, which mitigate the remote attack.

Update:

2019-1-5: GCDWebServer has fixed the Path Traversal vulnerability. However, most apps integrating this library have not upgrade their apps.

2018-12-20: GCDWebServer is deprecated by Ionic's Webview.

3. Model the Misusage

There are a few factors lead to a successful exploit toward apps using GCDWebServer.

3.1 App indicates to use LAN interface. Below code will defeat the attack toward network service.

In the view of a static analyzer, it should model the activity of NSDictionary object, as to solve value in the stack which preserve pointer point to the key-value pair. Moreover, it should model the memory which preserves the key-value pair, GCDWebServerOption_BindToLocalhost and @(YES) in this case.

3.2 When serving as a file server, web root folder should be set to Data folder. Below code snippet will expose the private Data folder to client.

3.3 If developers use GCDWebServer to provide customized service, they can add handlers for GCDWebServer. Since the implementation of handlers varies as developer wishes, manual analysis must be involved to check the handlers.

3.4 To verify the resource (nonsense files or privacy) behind the GCDWebServer, manual analysis must be involved.

4. Detect methodology

To make step 4.3-4.4 clearly, We take 3 code snippets for example.

Example 1:

This code will turn app to be a file server by using GCDWebServer library. Since IR for the code is boring and not easy to read (Appendix 4), to make the process explicitly, we use the equivalent (except for the SSA property) IDA disassembly.

__text:0000000100025748                 BL              _NSHomeDirectory

__text:000000010002574C                 MOV             X29, X29

__text:0000000100025750                 BL              _objc_retainAutoreleasedReturnValue

__text:0000000100025778                 STR             X0, [SP,#0x50+var_40]

__text:0000000100025784                 LDR             X3, [SP,#0x50+var_40]

1. After the dataflow analysis, we solved that X0 on call site 00000001000257B0 and 0000000100025790 point to the same object of GCDWebServer. They are calling [GCDWebServer start] and [GCDWebServer addGETHandlerForBasePath:directoryPath:indexFilename:cacheAge:allowRangeRequests] separately. (To reach 0000000100025700, the def of X0, we need to summary the function alloc and init.)
2. The second argument of 0000000100025790:_objc_msgSend, say X3, comes from 0000000100025748 (marked as `normal size text`), which is returned by calling _NSHomeDirectory method.

For this model, the checking rule is depicted as:

Example 2:

Checking Rule:

Example 3:

Checking Rule (A customized service, besides privacy, functionality may be provided. So, the web root folder is not checked.):

5. Analysis result

5.1 Out of 168,951 apps of our dataset, 2097 apps are spotted integrating GCDWebServer directly or indirectly, which is depicted in Appendix 1.

5.2 After filtering Ionic's Webview or AdColony library (Appendix 5), which are build on top of GCDWebServer , 729 apps are left (Appendix 2).

5.3 For the remaining 729 apps, we utilize our dataflow analyzer to translate the binary to intermediate representation (IR), 716 apps can be successfully parsed by our IR translate module.

5.4 After that, we apply intra-procedure dataflow analysis to solve variable in the IR.

5.5 Rules are applied to the dataflow analysis result to profile the dataset.

5.5.1 By using rules which model local host service and dead object reference, 199 apps which provide network service to local host or does not use the library (takes 24.72% of the dataset) are found in 716 apps. Among these apps, 46 apps wrapping (inherit) GCDWebServer, for we have preserved the hierarchies of classes, such variant can also be found by our analyzer.

5.5.2 We apply rules which model the pattern of GCDWebServer misusage to check the security of the 517 iOS apps. The analysis result is depicted in Appendix 3. To explain fields in the analysis result, we take Now app for example.

The analysis result reveals that the Now app: 1) use GCDWebServer as a file server, for it does not implemented it's own handler (DefaultHandlerForMethod, DefaultHandlerForMethod_async, HandlerForMethod, and HandlerForMethod_reg field). 2) does not set the BindToLocalhost argument as to use the LAN interface. 3) indeed use the GCDWebServer library (not a dead object as GCDWebServer field indicate). All these factors leads to a remote exploit towards the Now app.

5.6 We also category the usage of this library, the distribution is depicted as Table 4. After manually checking the reported potentially vulnerable apps, 83 apps really misuse the library. The left apps are still in manual checking pipeline for it's hard to trigger the service to verify the vulnerability. To solve such problem, we have tried to connect the code with UI to automatically reveal the network service behind user interaction, however, the undisclosed format of the .nib file, which stores the visual elements and relation between UI and code of an iOS app, impedes the static parsing task.

Appendix 1: 2097 apps integrate GCDWebServer.

Appendix 2: 729 apps integrate GCDWebServer but not Ionic's Webview and AdColony library.

Appendix 3: Analysis result (metadata)

Appendix 4: IR

Appendix 5: Query script